Interpretting Data from a Serialized Network Packet - sockets

Question

I have followed the tutorials on (https://pcapdotnet.codeplex.com) to setup my program for packet capturing and I am told that the packet is serialized by protobuf. Currently convertiing the packet to a string (like shown at the bottom) only works for a very little bit of information and will not suffice.
I can't figure out how to get the packet into an acceptable format from below to be able to deserialize it into a format I can use. Below is an example of the packet as it appears in Wireshark.
DRDNi|L.TE#4jcP""P.-h"
2
"
:
"
2
"
"
:
"
2
"
"
"
"
"
"
"
"
:
"
2
"$
"%
"4
"
"
"
"#
"
"
"
"4+
"
:
"
2
"
:
"
2
A?CCS2_121-/01
"C
"
:
"
2
"
:
"
I am expecting the packets to be in a format similar to this (from what I've been told).
list: <
show_entity: <
entity: 29
name: "EX1_306"
tags: <
name: 45
value: 3
>
tags: <
name: 47
value: 4
>
tags: <
name: 48
value: 2
>
tags: <
name: 49
value: 1
>
tags: <
name: 201
value: 3
>
tags: <
name: 202
value: 4
>
tags: <
name: 203
value: 2
>
tags: <
name: 218
value: 1
>
>
The code below is what I am using to capture the packet and convert it to the format where I can read a bit of the information. I can't get the protobuf to deserialize it into any format.
Private Sub PacketCap()
Dim Index As Integer = 0
Dim allDevices As IList(Of LivePacketDevice) = LivePacketDevice.AllLocalMachine
Dim device As LivePacketDevice = allDevices(1)
Dim Selecteddevice As PacketDevice = device
Using communicator As PacketCommunicator = Selecteddevice.Open(65536, PacketDeviceOpenAttributes.Promiscuous, 1000)
communicator.SetFilter("port 3724")
' read timeout
' start the capture
packetcount = 0
Invoke(New MethodInvoker(Sub()
MetroListbox1.Items.Add("Started Cap")
End Sub))
communicator.ReceivePackets(0, AddressOf PacketHandler)
End Using
End Sub
Private Sub MetroButton2_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MetroButton2.Click
Dim N As New Threading.Thread(AddressOf PacketCap)
N.Start()
End Sub
Private Sub PacketHandler(ByVal packet As PcapDotNet.Packets.Packet)
Invoke(New MethodInvoker(Sub()
'ListBox1.Items.Add(packet.Timestamp.ToString("yyyy-MM-dd hh:mm:ss.fff") & " length:" & Convert.ToString(packet.Length) + packet.ToString("X2"))
If packet.Length < 200 Then
Else
Const LineLength As Integer = 64
Dim Info As String
Dim i As Integer = 0
While i <> packet.Length
Info = Info + (packet(i)).ToString("X2")
If (i + 1) Mod LineLength = 0 Then
End If
i += 1
End While
End If
End Sub))
Sorry about the 'almost complete' formatting, this is my first question here. Any help is appreciated

Answer 1

The wire specification is here. However, the protobuf format is formally ambiguous in the absence of a schema (usually via a .proto file). There is no one single way of interpreting the data. However, you can probably make some wild guesses based on the wire-type (take the first 3 bits of the header).
0 is a varint; probably best to simply decode the varint and display it as though it is an int64
1 is 64-bit... tricky - no real way to choose between these; perhaps assume fixed64?
2 is length-prefixed - you could try the nested content to see if it is UTF-8; if it is, assume it is a string; otherwise, see if it parses as a sub-object; however, it could also be a packed array which is tricky
3 is start group - nested sub-object
4 is end group - end of the above
5 is 32-bit - like 1 - perhaps assume fixed32?
Frankly, though, this is going to be so hit and miss (mostly miss) that I don't see much point.